Bank of America hired 1,000 third-party contractors in Q2 to support 3,000 internal staff in patching proprietary and vendor software vulnerabilities exposed by advanced AI models including Anthropic's Mythos Preview, CEO Brian Moynihan told CNBC1,2.
Moynihan said the bank rushed earlier this year to remediate a wide spectrum of its internal and vendor code after frontier-class models demonstrated the ability to find exploitable flaws. "That risk is real risk, and that's why when the frontier-type models came out … a lot of us sat down and said, 'How do we figure out how to get through this quickly?'" Moynihan told CNBC's Leslie Picker.
The patching effort, combined with anti-money laundering compliance work, added a "couple hundred million plus" in third-quarter costs, according to Moynihan. He expects those remediation expenses to decline over time. The 1,000 contractors hired in Q2 remain engaged with BofA today.
Anthropic's Mythos Preview was released to a small group of banks, technology firms, and government agencies in April.
While the defensive patching created short-term expenses, BofA is running roughly 130 internal AI projects. Savings from those efforts are expected to rise from $300 million this year to $700 million in 2027.
ANALYSIS The scale of BofA's response—1,000 contractors on top of 3,000 internal staff, mobilized within a quarter—offers the clearest public signal yet that frontier AI vulnerability-discovery tools are forcing immediate, large-dollar remediation cycles at major financial institutions. The gap between the hundreds of millions spent on patching and the $700 million in projected AI savings frames the bank's AI exposure as a net cost today that management is betting flips positive by next year.
Separately, BofA's head count fell by about 3,400 employees in the past year, and the bank cut roughly 5% of managers.